-
Notifications
You must be signed in to change notification settings - Fork 121
Open
Description
It seems from the code that $eq permissions are always granted on a column, which probably snuck in as a way to allow things like the $not:5 token to work:
Lines 292 to 298 in 60d9e1e
| if ( | |
| token.operator && | |
| token.operator !== FilterOperator.EQ && | |
| !allowedOperators.includes(token.operator) | |
| ) { | |
| continue | |
| } |
In order to hit that line you have to make it past:
if (!(column in filterableColumns)) {
continue
}
which means this doesn't affect columns that aren't explicitly listed. But if my hunch is correct, then:
paginationConfig = {
filterableColumns: {
colA: [FilterOperator.LT],
colB: []
}
}
would give the $eq permission to both colA and more importantly for colB, which might leak unwanted filtering capacities to consumers?
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels